Critical NULL Pointer Dereference in Linux Kernel: Impacting Debian Linux Packages
Summary
DEBIAN-CVE-2024-43901: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401 When users run the command: cat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log The follow... Affects linux versions < 6.10.6-1. Fixed in 6.10.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing system resources and hardware communication. It provides essential services for all other software running on the system. This vulnerability affects Debian versions 13 and 14, specifically in the 'linux' package, which is crucial for system stability and performance.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD display driver (drm/amd/display) that leads to a NULL pointer dereference when users attempt to access the DTN log via the command 'cat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log'. This issue arises due to uninitialized data structures in the DCN401 ASIC, which can cause a kernel panic, potentially leading to system crashes and data loss. The vulnerability is classified under CVE-2024-43901 and affects users who utilize AMD graphics hardware.
How To Fix
Minimum fixed version
6.10.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid running the command 'cat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log' until the system is updated to the patched version. This will prevent the NULL pointer dereference from occurring.
Conclusion
The vulnerability CVE-2024-43901 in the Linux kernel poses a significant risk to users of Debian Linux, particularly those using AMD graphics hardware. It is crucial to update to the patched version of the 'linux' package to mitigate the risks associated with this vulnerability. Users are encouraged to monitor their systems and apply updates promptly.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43901 is a vulnerability in the Linux kernel that causes a NULL pointer dereference in the AMD display driver, potentially leading to system crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to kernel panics, system crashes, and potential data loss, affecting system stability.
Yes, a patch is available in the form of the updated 'linux' package version 6.10.6-1 or later.
If immediate updates are not possible, refrain from executing the command that triggers the vulnerability as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
